【发布时间】:2020-04-01 19:55:36
【问题描述】:
我动态构建以下 SQL 查询:
StringBuilder query = new StringBuilder();
StringBuilder query2 = new StringBuilder();
if (ComboRuleType.Text.Equals("Standard"))
{
query.Append("select * from [dbo].[" + ComboRuleTableName.Text + "]" + " WHERE" + "\n");
query.Append("(" + "\n");
for (int i = 0; i < dgvUpdateCriteria.RowCount; i++)
{
DataGridViewRow row = dgvUpdateCriteria.Rows[i];
if (i != 0)
{
query.Append(row.Cells[1].Value.ToString() + " " + row.Cells[3].Value.ToString() + " ");
}
else
{
query.Append(row.Cells[3].Value.ToString() + " ");
}
if (row.Cells[4].Value.ToString().Equals("Contains"))
{
query.Append("like " + "'%" + row.Cells[5].Value.ToString() + "%'" + "\n");
}
else if (row.Cells[4].Value.ToString().Equals("Equals"))
{
query.Append("= " + "'" + row.Cells[5].Value.ToString() + "'" + "\n");
}
else if (row.Cells[4].Value.ToString().Equals("StartsWith"))
{
query.Append("like " + "'" + row.Cells[5].Value.ToString() + "%'" + "\n");
}
else if (row.Cells[4].Value.ToString().Equals("EndsWith"))
{
query.Append("like " + "'%" + row.Cells[5].Value.ToString() + "'" + "\n");
}
}
query.Append(")" + "\n");
return query.ToString();
}
上面转换为Entity SQL后,如下图:
StringBuilder query = new StringBuilder();
StringBuilder query2 = new StringBuilder();
if (ComboRuleType.Text.Equals("Standard"))
{
query.Append("select value q1 from ");
query.Append(ComboRuleTableName.Text);
query.Append("s");
query.Append(" as q1 where " + "\n");
for (int i = 0; i < dgvUpdateCriteria.RowCount; i++)
{
DataGridViewRow row = dgvUpdateCriteria.Rows[i];
if (i != 0)
{
if (row.Cells[1].Value.ToString().Equals("AND"))
{
query.Append("&&" + " " + "q1." + row.Cells[3].Value.ToString());
}
else
{
query.Append("||" + " " + "q1." + row.Cells[3].Value.ToString());
}
}
else
{
query.Append("q1." + row.Cells[3].Value.ToString());
}
if (row.Cells[4].Value.ToString().Equals("Contains"))
{
query.Append(" LIKE (" + "'%" + row.Cells[5].Value.ToString() + "%'" + ")" + "\n");
}
else if (row.Cells[4].Value.ToString().Equals("Equals"))
{
query.Append(" == (" + "'" + row.Cells[5].Value.ToString() + "'" + ")" + "\n");
}
else if (row.Cells[4].Value.ToString().Equals("StartsWith"))
{
query.Append(" LIKE (" + "'" + row.Cells[5].Value.ToString() + "%'" + ")" + "\n");
}
else if (row.Cells[4].Value.ToString().Equals("EndsWith"))
{
query.Append(" LIKE (" + "'%" + row.Cells[5].Value.ToString() + "'" + ")" + "\n");
}
}
return query.ToString();
}
我构造了另一个包含 INNER JOIN 的 SQL 查询,我到处查看,但找不到该 SQL 查询到实体 SQL 查询的等效转换。如果您能帮助我,我将不胜感激。 INNER JOIN的动态SQL查询如下:
query.Append("SELECT * ");
query.Append("FROM [dbo].[membership] mm \n");
query.Append("INNER JOIN [dbo].[" + ComboRuleTableName.Text + "] xx \n");
query.Append("ON (mm.m_" + ComboRuleTableName.Text + "_id = xx.id) \n");
query.Append("WHERE xx.id IN ( \n");
query.Append("SELECT id from [dbo].[" + ComboRuleTableName.Text + "] \n");
query.Append("WHERE \n");
query.Append("mm.platform_name = '" + ComboRulePlatformName.Text + "' AND (\n");
for (int i = 0; i < dgvUpdateCriteria.RowCount; i++)
{
DataGridViewRow row = dgvUpdateCriteria.Rows[i];
if (i != 0)
{
query2.Append(row.Cells[1].Value.ToString() + " " + row.Cells[3].Value.ToString() + " ");
}
else
{
query2.Append(row.Cells[3].Value.ToString() + " ");
}
if (row.Cells[4].Value.ToString().Equals("Contains"))
{
query2.Append("like " + "'%" + row.Cells[5].Value.ToString() + "%'" + "\n");
}
else if (row.Cells[4].Value.ToString().Equals("Equals"))
{
query2.Append("= " + "'" + row.Cells[5].Value.ToString() + "'" + "\n");
}
else if (row.Cells[4].Value.ToString().Equals("StartsWith"))
{
query2.Append("like " + "'" + row.Cells[5].Value.ToString() + "%'" + "\n");
}
else if (row.Cells[4].Value.ToString().Equals("EndsWith"))
{
query2.Append("like " + "'%" + row.Cells[5].Value.ToString() + "'" + "\n");
}
else
{
query2.Append(" \n");
}
}
query2.Append("))\n");
return query.Append(query2).ToString();
我需要它是字符串格式。我后来将它从字符串转换为查询格式。我只是不知道INNER JOIN 语法如何与实体查询一起使用。
谢谢。
编辑 1:
这是我将该查询转换为实体框架对象查询的方法:
string query = EntityPreview(); //EntityPreview() is the method that gives me Raw Entity SQL Query
var objctx = (context as IObjectContextAdapter).ObjectContext;
if (ComboRuleTableName.Text.Equals("system"))
{
ObjectQuery<system> standardList = objctx.CreateQuery<system>(query);
rulePreviewForm.dataGridViewCriteriaRulePreview.DataSource = standardList;
rulePreviewForm.Show();
}
【问题讨论】:
-
哇。 Sql注入多吗?
-
是的。这就是我使用实体框架对象上下文来运行实体 SQL 查询的原因。你能帮帮我吗?
-
您的问题不是 Raw Sql vs EF。您的问题是连接字符串以构建查询,您在 EF 示例中似乎仍在执行此操作。
-
当您提到 Entity SQL 时,您指的是 Entity Framework 以及创建 IQueryable 类型的能力吗?
-
我在上面的代码中没有看到任何 EF 绑定或 LINQ。如果是 EF,我们会看到 IQueryable 类型。
标签: c# sql entity-framework entity-sql